Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

AWN-194614 #88

Merged
merged 4 commits into from
Apr 4, 2023
Merged

AWN-194614 #88

Changes from 2 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
c48f85a
added guide
laiba-zaman Mar 28, 2023
dd0fdc6
Update service-account-token-creator.md
laiba-zaman Mar 31, 2023
100d6c2
Update service-account-token-creator.md
laiba-zaman Apr 4, 2023
0ddb7a1
Update service-account-token-creator.md
areed42 Apr 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
27 changes: 27 additions & 0 deletions en/google/iam/service-account-token-creator.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,27 @@
[![CloudSploit](https://cloudsploit.com/img/logo-new-big-text-100.png "CloudSploit")](https://cloudsploit.com)

# GOOGLE / IAM / Service Account Token Creator

## Quick Info

| | |
|-|-|
| **Plugin Title** | Service Account Token Creator |
| **Cloud** | GOOGLE |
| **Category** | IAM |
| **Description** | Ensures that no users have the Service Account Token Creator role. |
| **More Info** | For best security practices, IAM users should not have Service Account Token Creator role. |
| **GOOGLE Link** | https://cloud.google.com/compute/docs/disks |
| **Recommended Action** | Ensure that no IAM user have Service Account Token Creator Role at GCP project level.|

## Detailed Remediation Steps
1. In the Google Cloud console, go to the IAM page.

[Go to IAM](https://console.cloud.google.com/projectselector/iam-admin/iam?supportedpurview=project,folder,organizationId)

2. Select a project, folder, or organization (in this case the GCP project).

The Google Cloud console lists all the principals who have been granted roles on your project, folder, or organization. This list includes principals who have inherited roles on the resource from parent resources. For more information about policy inheritance, see [Policy inheritance and the resource hierarchy](https://cloud.google.com/iam/docs/policies#inheritance).
Check to see if any have the Service Account Access Role.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make this another step. This way there are 4 in total.


3. Optional: To view role grants for [Google-managed service accounts](https://cloud.google.com/iam/docs/service-account-types#google-managed), select the Include Google-provided role grants checkbox.